CVE-2026-89271: medium-severity vulnerability in WP-BusinessDirectory
WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.2%
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · WP-BusinessDirectorypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/78b3ade9-1614-4040-87be-c43dbc50b79e/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.